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Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 03 MONTH(S) OR THIRTY (30) DAYS, 

WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment See 37 CFR 1.704(b). 

Status 

1 )[3 Responsive to communication(s) filed on 01 December 2003 . 
2a)D This action is FINAL. 2b)S This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) [3 Claim(s) 1-20 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) ^ Claim(s) 1-20 is/are rejected. 

7) 0 Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) S The specification is objected to by the Examiner. 

10)^ The drawing(s) filed on 01 December 2003 is/are: a)D accepted or b)^ objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 

Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
1 1 )□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-1 52. 

Priority under 35 U.S.C. § 119 

12)^ Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 
a)G3 All b)D Some * c)D None of: 

1 :□ Certified copies of the priority documents have been received. 

2. Q Certified copies of the priority documents have been received in Application No. . 

3. D Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 



2. 



1. 



This is in response to the communication filed on 12/01/2003. 
Claims 1-20 are pending in the application. 



3. 



Claims 1-20 have been rejected. 



Priority 



4. Acknowledgment is made of applicant's claim for foreign priority under 35 U.S.C. 1 19(a)- 
(d). The certified copy has been filed in parent Application No. EP 02354194.9, filed on December 
13,2002. 



5. The drawings are objected to under 37 CFR 1.83(a). 

The drawings must show every feature of the invention specified in the claims. Therefore, 
the limitations such as " comparing the pseudo-signature with software trace", and " a pseudo- 
signature generation element operative to produce a software trace... whereby trace may be 
conveyed as a virus pseudo-signature", and " a virus scanning engine and a signature table 
containing a plurality of virus signature", must be shown or the feature(s) canceled from the 
claim(s). No new matter should be entered. 

Corrected drawing sheets in compliance with 37 CFR 1.121(d) are required in reply to the 
Office action to avoid abandonment of the application. Any amended replacement drawing sheet 
should include all of the figures appearing on the immediate prior version of the sheet, even if only 
one figure is being amended. The figure or figure number of an amended drawing should not be 
labeled as "amended." If a drawing figure is to be canceled, the appropriate figure must be removed 
from the replacement sheet, and where necessary, the remaining figures must be renumbered and 
appropriate changes made to the brief description of the several views of the drawings for 



Drawings 
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consistency. Additional replacement sheets may be necessary to show the renumbering of the 
remaining figures. Each drawing sheet submitted after the filing date of an application must be 
labeled in the top margin as either "Replacement Sheet" or "New Sheet" pursuant to 37 CFR 
1.121(d). If the changes are not accepted by the examiner, the applicant will be notified and 
informed of any required corrective action in the next Office action. The objection to the drawings 
will not be held in abeyance. 

Specification 

6. The title of the invention is objected because of not being descriptive. A new title is 
required that is clearly indicative of the invention to which the claims are directed. In the instant 
case, claim language is directed to generating and detecting a virus pseudo-signature as a part of 
anti-virus update procedure which is different from what disclosed in the title. 

7. The abstract of the invention is objected because of not being in correct format. Applicant 
is reminded of the proper language and format for an abstract of the disclosure. 

Abstract submitted on 12/01/2003, includes a title therein (in separate paragraph!), and 
considered not submitted in a separate sheet as should be. 

Furthermore, the abstract is consist of fewer than 50 words, and barely discloses the subject 
matter of only one of the independent claims, thus fails to be narrative, and able to disclose the 
invention as whole clearly and concisely as expected. 

The abstract should be in narrative form and generally limited to a single paragraph on a separate sheet within 
the range of 50 to 150 words. It is important that the abstract not exceed 150 words in length since the space provided 
for the abstract on the computer tape used by the printer is limited. The form and legal phraseology often used in patent 
claims, such as "means" and "said," should be avoided. The abstract should describe the disclosure sufficiently to assist 
readers in deciding whether there is a need for consulting the full patent text for details. 
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The language should be clear and concise and should not repeat information given in the title. It should avoid 
using phrases which can be implied, such as, "The disclosure concerns," "The disclosure defined by this invention," 
"The disclosure describes," etc. 

Claim Objections 

8. Regarding claim 20, it is objected to under 37 CFR 1 .75(c) as being in improper form 
because a multiple dependent claim 19 can not be followed by another multiple dependent claim. 
See MPEP § 608.01(n). Accordingly, the claim 20 has not been further treated on the merits. 

Claim Rejections - 35 USC § 112 
The following is a quotation of the first paragraph of 35 U.S.C. 1 12: 

The specification shall contain a written description of the invention, and of the manner and process of making and 
using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with 
which it is most nearly connected, to make and use the same and shall set forth the best mode contemplated by the inventor of 
carrying out his invention. 

The following is a quotation of the second paragraph of 35 U.S.C. 1 12: 

The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject 
matter which the applicant regards as his invention. 

9. Claims 1-20 are rejected under 35 U.S.C. 1 12, first paragraph, as failing to comply with the 
enablement requirement. The claim(s) contains subject matter which was not described in the 
specification in such a way as to enable one skilled in the art to which it pertains, or with which it is 
most nearly connected, to make and/or use the invention. 

Regarding claims 1, 11, 12, and 14-18, they recite the limitations such as "identifying a 
software trace. ..as a virus pseudo-signature" and "produce a software trace.. .as a virus 
pseudo-signature", however, no where in the specification or drawings an example of such 
software trace or virus pseudo-signature is shown. Although specification (Par [0007], [0026], and 
[0029]) defines virus pseudo-signature as a non-virus component that appears to a virus, at the 
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time of invention, one skilled in the art would only know what a virus signature might look like, not 
what a pseudo-signature would look like or appear , or what would be the exact differences 
between a virus signature and virus pseudo-signature. Therefore, at the time of invention, one 
skilled in the art would not be able to produce a virus pseudo-signature as intended, nor will be able 
to differentiate between a virus signature and virus pseudo-signature. 

Claims 2-10, 13 and 19-20 are rejected under 35 USC 1 12 first paragraph because of their 
dependencies on the independent claims. 

Claim Rejections - 35 USC § 101 
35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any 
new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this 
title. 

10. Claims 1-1 1 and 15-17 are rejected under 35 U.S.C. 101 for the following reasons: 

Regarding claims 1-11, the claimed invention lacks patentable utility. In particularly, 

although a method of detecting. . .the presence of virus pseudo-signature is claimed, claim steps fail 

to incorporate such essential detection/ comparison/ distinguishing step at the end to produce a 

practical/ useful result. See MPEP § 2107. 

Regarding claims 15-17, the claimed invention is directed to non-statutory subject matter , 

and considered to be program or software per se product. See MPEP § 2106.01 . 

Claim Rejections - 35 USC § 102 
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 
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A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by another filed in the 
United States before the invention by the applicant for patent or (2) a patent granted on an application for patent by another filed in 
the United States before the invention by the applicant for patent, except that an international application filed under the treaty 
defined in section 351(a) shall have the effects for purposes of this subsection of an application filed in the United States only if the 
international application designated the United States and was published under Article 21(2) of such treaty in the English language. 

1 1 . Claims 1-20 are rejected under 35 USC 102 (b) as being anticipated by Hvpponen et al (US 
6577920 Bl). 

Regarding claim 1, Hv pponen et al discloses a method of detecting a non-virus component 
in a virus-protected computer system comprising identifying a software trace of the component (Col 
2, starting at line 24; Col 3, starting at line 34; screening; identifying signature indicative of virus 
free macros) and conveying the trace to the computer system as a virus pseudo-signature to allow 
detection of the component by the system's antivirus software (Col 2, starting at line 24; Col 5, 
starting at line 8; sending macro signatures from network manager to user; scanning/ screening for 
virus free macros) . 

Regarding claim 11, Hvpponen et al discloses a method of facilitating the detection of a 
non-virus component in a first virus-protected computer system comprising identifying, on a second 
computer system, a software trace of the component (Col 2, starting at line 47; Col 5, line 8-22; 
network manager; host/ user application), and conveying the trace towards an antivirus update 
source whereby the software trace may be passed, as a virus pseudo-signature, to the first computer 
system (Col 2, starting at line 24; updating databases with macro signatures; signature indicative of 
virus free macros). 
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Regarding claim 12, Hv pponen et al discloses a method of detecting, in a virus-protected 
computer system, the presence of a non- virus component comprising receiving a virus pseudo- 
signature associated with a software trace of the non-virus component (Col 2, starting at line 24; 
Col 3, starting at line 34; screening; identifying signature indicative of virus free macros), and 
comparing the pseudo-signature with software traces disposed within the system's memory (Col 3, 
starting at line 34; determining). 

Regarding claim 14, Hv pponen et al discloses an apparatus for detecting, in a virus- 
protected computer system, a non-virus component, comprising a pseudo-signature generation 
element operative to produce a software trace of the component (Col 1, starting at line 65; Col 4, 
starting at line 50; signature/ checksum calculation), and an antivirus support source whereby the 
software trace may be conveyed, as a virus pseudo-signature, to the computer system (Col 2, 
starting at line 24; Col 3, starting at line 34; screening; identifying signature indicative of virus free 
macros). 

Regarding claim 15-18, they recite the limitations of claims 1-14, therefore, they are 
rejected applying as above rejecting claims 1-14. 

Regarding claim 2, Hv pponen et al discloses a method wherein the trace is conveyed to 
the computer system as part of an update procedure, whereby additional virus signatures or 
scanning engines may also be passed to the antivirus software (Col 2, starting at line 24; updating 
databases with macro signatures ). 
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Regarding claim 3, Hy pponen et al discloses a method wherein the component is a 
hardware device and wherein the software trace is indicative of the presence of the device in the 
computer system (Col 5, starting at line 10; controller; anti-virus software ). 

Regarding claim 4, Hy pponen et al discloses a method wherein the software trace is 
resident in a volatile area of the system's memory (Col 3, starting at line 34; memory storing 
signatures indicative of virus free macros). 

Regarding claim 5, Hy pponen et al discloses a method wherein the pseudo-signature is 
tagged or otherwise marked to distinguish it from authentic virus signatures (Col 3, starting at line 
2; certified/ set of signatures indicative of virus free macros) . 

Regarding claim 6, Hy pponen et al discloses a method wherein the antivirus software is 
modified so as to react differently to the presence of pseudo and authentic virus signatures (Col 1, 
starting at line 63; each micro having signature/ checksum). 

Regarding claim 7, Hypponen et al discloses a method wherein the modification is effected 
as part of the update procedure (Col 2, starting at line 24; updating; macro signatures). 

Regarding claim 8, Hypponen et al discloses a method wherein the antivirus software does 
not attempt to fix, clean, modify or delete the component associated with the pseudo-signature ( Col 
5, starting at line 15; only manager has authority to modify signature database). 
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Regarding claim 9, Hy pponen et al discloses a method wherein detection of the pseudo- 
signature causes an advisory message to be conveyed to a user of the system, advising the user of 
the presence of the detected component (Col 3, starting at line 23; alerting). 

Regarding claim 10, Hypponen et al discloses a method wherein detection of the pseudo- 
signature effects a connection to a website providing details of the component concerned (Col 3, 
starting at line 1 ; central site). 

Regarding claim 13, Hypponen et al discloses a method wherein, in the event of a match 
being found, the antivirus software of the system is operative to convey, to a user of the system, an 
advisory message advising of the presence of the detected component (Col 3, starting at line 23; 
alerting). 

Regarding claims 19-20, they recite the limitations of claims 5-6, therefore, they are 
rejected applying as above rejecting claims 5-6. 

Conclusion 

12. A shortened statutory period for response to this action is set to expire in 3 (Three) months 
and 0 (Zero) days from the mailing date of this letter. Failure to respond within the period for 
response will result in ABANDOMENT of the application (see 35 U.S.C 133, M.P.E.P 710.02(b)). 

Any inquiry concerning this communication or earlier communications from the examiner 
should be directed to Shanto M Abedin whose telephone number is 571-272-3551. The examiner 
can normally be reached on M-F from 9:00 AM to 5:30 PM. If attempts to reach the examiner by 
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telephone are unsuccessful, the examiner's supervisor, Moazzami Nasser, can be reached on 571- 
272-4195. The fax phone number for the organization where this application or proceeding is 
assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR system, 
see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, 
contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 

Shanto M Abedin 



Examiner, AU2136 




NASSER MOAZZAMI 




